Introducing HTTP Anomaly Rank
Summary: PortSwigger researcher James Kettle released HTTP Anomaly Rank, an algorithm that scores each HTTP response by how different it is from the rest of a result set, weighting attributes by their stability and flagging responses with unique values. It is integrated into Turbo Intruder, which now sorts results by anomaly rank when an attack completes, and into Burp Suite's API in release 2025.10.
What's compelling: The algorithm grew out of the diffing logic behind Kettle's 2016 Backslash Powered Scanner work on automating human intuition, and PortSwigger notes it is particularly useful for anyone building AI-based features because it can sift through massive result sets at O(N) complexity. Manual triage of thousands of noisy responses is where subtle findings get missed, and that is the gap this is aimed at.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026